I’m building a self-hosted auth service for multiple APIs. Where would it fall short?

Centralized, self-hosted authentication for every API you run: private by default, GDPR-ready.